The main job of a Digital Forensics Specialist is to perform recovery and investigation of material found in digital devices. The Digital Forensics Specialist has a technical background and has to be able to apply knowledge of computer forensic principles in the identification and collection of digital evidence.
The main job of a Digital Forensics Specialist is to perform recovery and investigation of material found in digital devices. The Digital Forensics Specialist has a technical background and has to be able to apply knowledge of computer forensic principles in the identification and collection of digital evidence.
Objective
The Digital Forensics officer must have a technical background and practical knowledge ofcomputer forensic principles for identification and collection of digital evidence.
The basic level course for Incident Responder's track shall help the Law Enforcement Agencies gain an understanding of following subjects:
- Different types of cyber crimes.
- What is Digital evidence and analysis of digital Evidence.
- How to preserve the integrity of digital evidence, admissibility of digital evidence in court of law and maintaining the chain of custody.
- Familiarity with different operating systems and applications and file structures.
- Whatis digital forensics and different phases of digital forensics – Identification, Preservation, Acquisition, Authentication and Documentation, also known as IPAAD.
- Standard Operating Procedure for digital forensic process in Indian context.
- Importance of documentation and the documents to be submitted with digital evidence.
- Knowledge of relevant commercial and open-source digital forensics tools such as EnCase, FTK Imager etc.
- Usage of FTK Imager for acquisition of volatile and non-volatile digital evidence through tool demonstration and simulation.
- Usage of EnCase for analysis of evidence.
The cyber-crime fundamentals and handling of digital evidence is explained through case scenarios and demonstration/simulation of tools along with Standard Operating Procedures (SOP)
Estimated Effort: 8 Hours
Objective
The digital forensic domain involves forensic acquisition, analysis and reporting of digital artefacts from various digital devices such as computers, smart phones, feature phones, satellite phones, networking devices such as routers & switches, digital cameras, CCTV systems, GPS and other related devices. Digital devices can be volatile in nature and hence it is vital that the experts should know the different methods to collect volatile data. Due to different operating systems used by OEMs and manufacturer’s it is important to cover leading operating system based forensic techniques.
The objective of this course is for law enforcement agencies to gain an intermediate level knowledge of the following topics related to digital forensics:-
- Develop Cybercrime Awareness including Legal and Jurisdiction Issues in relation to Digital Forensics .
- Understand Live Data / Triaging Forensics for Laptops, Servers and Mobile Phones including overview of various Tools.
- Understand Random Access Memory (RAM) Analysis using Triage Tools.
- Insight into Windows Forensics including Registry, Data Hiding Locations, Event Log and Forensic Image Analysis.
- Overview of Linux & Mac Forensics including Filesystem Forensics.
- Understanding Mobile Forensics including various Platforms, Tools, SIM Card Data Extraction and Live Mobile Acquisition.
- Understanding Network Forensics including Protocol Analysis, Layer wise Analysis, Flow Analysis and Wireless Analysis.
- Malware Analysis and Reverse Engineering using Static, Dynamic, Code and Behavioural Analysis.
- Introduction to Virtual Machines and VM Forensics.
- Overview of Cloud Forensics including Legal Aspects.
- Internet of Things (IOT) Forensics including Smart Watch, Raspberry Pi and Arduino Forensics.
- Handling Encrypted Evidence and SOP.
- Collecting Artifacts of TOR Browser.
The prerequisite for this course is Digital Forensics Track – Basic Level Course.
Estimated Effort: 15 Hours
Objective
The solution of most of the advanced cybercrime cases require careful gathering and forensic investigation of digital evidence. Procedures of digital forensics must be known to cyber police personnel in order to open up pathways for investigation and also avoid technical pitfall while handling digital evidence.
The objective of this course is to provide understanding of the following areas relevant to digital forensics:-
- Mobile forensics including VOIP,mobile forensics, JTAG & Chip off techniques, forensics analysis of mobile phone data, analysis of mobile application and techniques for lawful interception of mobile phones.
- Understand Network Forensics including event log analysis, network device analysis and investigating DoS,phishing &web defacement attacks.
- Digital Forensics (Advance Level) using Commercial Tools including live / remote imaging.
- Advanced Malware Analysis including lab establishment, static and dynamic analysis of malware and overview of IDA.
- Advance Dark web and Cryptocurrency Forensics including TOR Browser, Understanding of crypto technology, blockchain and cryptocurrency analysis.
- Cloud Forensics to include cloud artefacts and Cloud Service Provider specific technologies and acquiring evidence from host PC.
- Forensics Scripting overview including SQL and SQLite.
- CCTV Forensics including SOP and enhancement of CCTV Footage/video clip
- Audio/Video Forensics and enhancement of audio / video clips.
The prerequisite for this course is Digital Forensics Track – Intermediate Level Course.
